add "api_token" column to "auth_users" table, generate API tokens database-side
show API token in web UI